March 9th, 2010 Security Conference Call

Security Work Group Weekly Conference Call

Attendees

Anticipated

• Tabitha Albertson
• Bernd Blobel Security Co-chair, absent
• Jim Buckner
• Steven Connolly
• Mike Davis Security Co-chair, absent
• Suzanne Gonzales-Webb CBCC Co-chair, absent
• Rob Horn
• Don Jorgenson
• John Moehrke Security Co-chair
• Milan Petkovic
• Pay Pyette
• Ioana Singureanu
• Serafina Versaggi scribe
• Craig Winter

Agenda

1. (05 min) Roll Call, Minutes March 2, 2010 & Call for Additional Agenda Items
2. REPORT OUTS
   • (5 min) RSA Conference
   • (5 min) HIMSS Conference
3. ACTIVE PROJECTS
   • (5 min) Security and Privacy Ontology project
   • (5 min) PASS Audit
4. (40 min) Harmonized Privacy and Security DAM Peer Review

Announcements

An update to the Harmonized Security Domain Analysis Model presentation has been posted on GForge in the Doc section under the Security Domain Analysis (DAM) Project folder

• Update to this presentation includes:
  • Added analysis for Use Case S.4 Negotiate Privacy Policy
    • Slides were added at the end of the presentation
    • They show how the use case relates to technical implementation of the Access Control System (ACS)
    • The elaboration shows how to automate the use case – as there needs to be a way for the consenter to submit privacy preferences that could be adjudicated by the ACS in an automated fashion since the use case is a set of manual steps
    • The elaboration assumes that the work for the use case is performed by automated systems
    • Sequence diagram shows the final step of the negotiation (consenter has the choice to accept the outcome of the negotiation or to reject it, in which case, nothing is done
  • The Related Information and Associations slides show the information related to the Negotiate Privacy Policy use case and the relationships between the classes to arrive at the Information Model
  • The model has NOT been changed – the additional slides describe the analysis flow from the business use cases to the technical use cases, sequence diagrams and information model.